deny IPs from wp-login using .htaccess

Question

i am trying to ban a spam bot IP from my wordpress, since the "limit login attempts" extension mails me multiple times every day, that the same IP is trying to login. so i added the following to the .htaccess file in the wordpress root:

order allow,deny
allow from all
deny from x.x.x.x

with x.x.x.x being the IP of the bot. still the bot is trying to login. so i tried my own IP and found out, that the htaccess order does only block the css of the login page. mywordpress.com/wp-login.php still shows the login form, though without any styling, but the bot can still try to gain access.

so how can i really block the entire site including the backend from certain IPs?

Answer 1

I think you've got it backwards. Try

order allow,deny
deny from x.x.x.x
allow from all

That should block all URLs from that IP.

And Limit Login Attempts http://wordpress.org/extend/plugins/limit-login-attempts/ can be set to not email you with each lockout. Set the lockout timeouts to 9999 hours, too, which is the maximum setting.

If things still don't work, deactivate other plugins that might be intercepting calls to or reads of .htaccess.

Answer 2

You should also consider blocking entire ranges of IP addresses if they come from countries that aren't a part of your normal reader base. Russia, China, and some countries in Euorpe are notorious for turining a blind eye to spammers and other bots that can wreak havock on your system. Just locate the offending IP in your log file and look it up in whois. The whois record should list the ip range it's a part of and then block it.

Edit - If you look at your log files you can easily tell who the offenders are. I had to ban hundreds of IP ranges because it severely effected the performance of my server (over 500K unique non spam/bot users a month).